CWE-552 Files or Directories Accessible to External Parties
baseThe product makes files or directories accessible to unauthorized actors, even though they should not be.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (570)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-21589US | high7.5OT kritisch | KEV | ||
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Cru… | ||||
| CVE-2025-11371US | —OT kritisch | KEV | ||
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system… | ||||
| CVE-2025-48928US | —OT kritisch | KEV | ||
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over H… | ||||
| CVE-2020-17519US | high7.5OT kritisch | KEV | ||
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST… | ||||
| CVE-2017-16651US | high7.8OT kritisch | KEV | ||
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, a… | ||||
| CVE-2016-3715US | medium5.5OT kritisch | KEV | ||
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. | ||||
| CVE-2023-50164US | critical9.8 | Exploit | ||
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote… | ||||
| CVE-2020-15175US | critical9.1 | Exploit | ||
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the… | ||||
| CVE-2017-14942US | critical9.8 | — | ||
Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg… | ||||
| CVE-2024-53676US | critical9.8 | — | ||
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. | ||||
| CVE-2024-39931US | critical9.9 | — | ||
Gogs through 0.13.0 allows deletion of internal files. | ||||
| CVE-2021-39316US | medium5.0 | Exploit | ||
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action… | ||||
| CVE-2023-2766US | high7.5 | — | ||
A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_… | ||||
| CVE-2024-6209US | high7.5 | Exploit | ||
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series
v3.08.01
; MATRIX Series
v3.08.01 allows Attacker to access files unauthorized | ||||
| CVE-2023-33568US | high7.5 | Exploit | ||
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee in… | ||||
| CVE-2021-43008US | high7.5 | Exploit | ||
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Admine… | ||||
| CVE-2021-25741US | high8.1 | Exploit | ||
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, includi… | ||||
| CVE-2018-16946US | high7.5 | Exploit | ||
LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download bac… | ||||
| CVE-2023-36664US | high7.8 | Exploit | ||
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). | ||||
| CVE-2022-41343US | high7.5 | Exploit | ||
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-fac… | ||||
04
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan